Key Signing Policy for Sebastian Inacker. http://www.inacker.de/gpg/policy.txt Version 2005/06/26 pub 1024D/E05C21AF 2003-07-19 Sebastian Inacker Key fingerprint = 1B69 2B1B B62B 1789 AEEF 4F9D 6640 15D7 E05C 21AF uid Sebastian Inacker uid Sebastian Inacker uid Sebastian Inacker sub 1024g/689EB113 2003-07-19 sub 1024D/622349DC 2003-07-25 This policy is valid from 2004/01/01 for signatures made by my GnuPG key with Key ID 0xE05C21AF. (Some signatures before this date were also made under the following conditions. No key was ever signed without checking the identity of the person and the fingerprint.) Before I sign a key, I - verify the identity of the person owning the to-be-signed key by either knowing them for a long time or looking at their identity card or equivalent proof of identity. - receive the key fingerprint from the key owner directly. A signature is always on an user id. By signing an user id, I confirm - that the person, who gave me the fingerprint of that key, has the claimed name. Description of my use of trustlevels: sig3 - I have verified the identity and verified, that the e-mail address of the signed uid belongs to the person, who has control over the key. This is done by a challenge-response system or by sending the signed key to the corresponding user id (both via encrypted mail). sig2 - I have verified the identity - but not the e-mail address (for example because the key does not support encryption to it). sig1 - unused at the moment. You can get my key from keyservers, which should support multiple subkeys (like subkeys.pgp.net or random.sks.keyserver.penguin.de) or from my website: http://www.inacker.de/gpg/E05C21AF.asc CHANGELOG 2005/06/26 Description of trustlevel sig3 changed. Analogously: Check for control over the key is done by (encrypted) challenge-response or (NEW) sending the signed key by encrypted mail to the owner. Changed named keyservers to subkeys.pgp.net / random.sks.keyserver.penguin.de Old policy: http://www.inacker.de/gpg/policy.until_20050626.txt